Looks like they are using zxcvbn[1] to calculate the password entropy and converting it to a time with these parameters: computers speed fact

Looks like they are using zxcvbn[1] to calculate the password entropy and converting it to a time with these parameters: computers speed factor ------------------------------------------------ ZX Spectrum k: 1300 // 30 guesses per hour (?) Mac Book Pro (2012) k: 1 // 10 guesses per second (?) Conficker botnet k: 5e-5 // 20000 guesses per second (?) Tianhe-2 Supercomputer, k: 3e-7 // 3000000 guesses per second (?) The following line of code suggests that the speed factor is compared to 10 password guesses per second: Passwrdr.crack_time = result['crack_times_seconds']['online_no_throttling_10_per_second']; [1] https://github.com/dropbox/zxcvbn https://github.com/dropbox/zxcvbn